Is Plaud HIPAA Compliant? Kind Of. Here's What to Know (2026)

Plaud holds HIPAA certification verified through a third-party assessment and maintains SOC 2 Type II, ISO 27001, and AES-256 encryption. However, healthcare providers cannot legally use it with patient data without a signed Business Associate Agreement (BAA), required under HIPAA for any vendor handling Protected Health Information, and Plaud has not publicly offered one.

Last updated: August 4, 2026

If you are a healthcare professional considering the Plaud NotePin for recording patient sessions, you have probably asked the same question everyone else is asking: Is Plaud HIPAA compliant?

The short answer is yes, kind of. Plaud has obtained HIPAA certification, and their security stack is genuinely impressive. But there is a critical gap between "HIPAA certified" and "safe to use with patient data" that every clinician needs to understand before pressing record.

This guide breaks down exactly what Plaud's compliance covers, where the gaps are, how state recording laws create additional legal exposure, and what you need to do to protect yourself and your patients.

What Plaud's HIPAA Compliance Actually Means

Plaud has built one of the more robust security frameworks in the AI recording space. Their trust page and Drata compliance portal document an impressive list of certifications.

Plaud's Security Certifications

Here is what Plaud currently holds:

• SOC 2 Type II: Independent audit validating security, availability, processing integrity, confidentiality, and privacy controls
• HIPAA: Healthcare data protection compliance verified through third-party assessment
• GDPR: Full EU data protection compliance (achieved July 2025)
• CCPA/CPRA: California consumer privacy compliance
• ISO 27001: Information security management standard
• ISO 27701: Privacy information management standard
• EN 18031: Hardware physical and logical security

Encryption and Data Protection

Plaud's technical security measures include:

• TLS encryption in transit with a secondary application-level encryption layer using unique keys
• AES-256 encryption at rest for all stored data
• On-device AES-256 chip-level encryption on the NotePin hardware, so data cannot be read without paired account credentials even if the physical device is stolen
• AWS US West (Oregon) infrastructure, a SOC 2 and ISO 27001 certified data center
• Zero-training guarantee in their 2026 Enterprise Terms. Patient data is processed through isolated instances and deleted from processing cache after transcription is finalized

This is genuinely solid for a consumer-grade AI recording device. But here is where the story gets complicated.

The BAA Problem: Why HIPAA Certification Is Not Enough

Here is the critical nuance that Plaud's marketing buries: HIPAA certification for a vendor is not the same as making your healthcare use automatically compliant.

First, a clarification. There is no official government-issued "HIPAA certification." What Plaud means, and what is standard industry practice, is that they have undergone independent third-party assessment and their controls meet HIPAA requirements. That is legitimate, but it is only one piece of the compliance puzzle.

What Is a Business Associate Agreement?

Under HIPAA, any third-party vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a healthcare provider must sign a Business Associate Agreement (BAA). This is a legally binding contract required by federal law.

A BAA must include:

• Permitted and required uses of PHI
• Obligation not to use PHI beyond what the contract allows
• Requirement to implement administrative, physical, and technical safeguards
• Breach notification procedures
• Subcontractor compliance provisions
• PHI return or destruction at contract termination
• HHS access to records for compliance audits

Does Plaud Offer a BAA?

This is where the gap exists. Despite extensive review of Plaud's support documentation, enterprise FAQ, trust page, healthcare solution page, and blog posts, there is no public evidence that Plaud offers a Business Associate Agreement.

Their healthcare marketing is aggressive. They run a dedicated healthcare solution page, SOAP note templates, clinical note formatting, and a healthcare professionals discount. None of these materials mention a BAA.

This creates a paradox. Plaud markets directly to healthcare professionals while apparently not providing the one legal document that healthcare professionals need before using any recording tool with patient data.

What Happens If You Use Plaud Without a BAA?

Using any tool that handles PHI without a signed BAA is itself a HIPAA violation, regardless of how strong the tool's security features are. The consequences are serious:

These penalty amounts were updated January 28, 2026 by HHS. One caveat on the annual caps: the statutory inflation adjustment sets a single $2,190,294 calendar-year cap for identical violations, and the lower tier-by-tier caps trace to an HHS enforcement policy adopted in 2019 that was never formally codified. Treat the lower caps as enforcement practice rather than a fixed statutory limit.

Under the HITECH Act, both the covered entity (you, the healthcare provider) and the business associate (Plaud) can face enforcement.

Beyond fines, a HIPAA violation can trigger loss of Medicare/Medicaid contracts, mandatory corrective action plans, increased regulatory oversight, and reputational damage. In cases of willful neglect, criminal penalties including prison time are possible.

Bottom line: If you are a healthcare provider, contact Plaud directly and get a signed BAA in writing before using it with any patient data. Without one, you are exposed regardless of their certifications.

One-Party vs. All-Party Consent: The Bigger Practical Problem

Even with perfect HIPAA compliance, recording conversations introduces a second layer of legal risk that many Plaud users overlook: state recording consent laws.

Plaud's own guidance on consent is surprisingly thin. Their website essentially says to take a moment to let others know and get their okay before recording. That is legally inadequate in many jurisdictions.

Federal Law: The Baseline

The federal Wiretap Act (18 U.S.C. § 2511) prohibits intercepting communications but includes a critical exception: recording is lawful when one party to the communication has given prior consent. This makes federal law a one-party consent standard.

Federal violations carry up to 5 years imprisonment and fines up to $250,000. Civil remedies under 18 U.S.C. § 2520 allow actual or statutory damages plus attorney's fees.

But federal law sets a floor, not a ceiling. States can and do impose much stricter requirements.

All-Party Consent States (2026)

The following states require every participant to consent before recording begins, at least for some categories of private conversation:

Note on Oregon, and why it matters most for a wearable. Oregon splits its rule by medium, and the split runs the opposite way from Nevada's. ORS 165.540(1)(c) makes it unlawful to obtain any part of a conversation with a recording device "if not all participants in the conversation are specifically informed that their conversation is being obtained," while subsection (1)(a) applies a one-party consent standard to telecommunications and radio communications. A violation is a Class A misdemeanor. Because the Plaud NotePin is worn during in-person encounters, Oregon's stricter in-person rule is the one that governs most Plaud use in that state.

Note on Nevada: Nevada has a hybrid rule running the other direction. Nevada law requires all-party consent for telephone calls (NRS 200.620) but only one-party consent for in-person conversations.

Note on Michigan: Michigan's status remains legally ambiguous. The statute (MCL 750.539c) technically requires all-party consent, but Michigan courts have interpreted it to allow participant recording. The Michigan Supreme Court declined to resolve the question definitively, creating ongoing legal uncertainty.

One-Party Consent States

In the remaining states, including New York, Texas, and Virginia, you can legally record a conversation as long as you are a participant. You do not need to inform the other parties. See the full list of one-party consent states.

The Cross-State Problem

When call participants are in different states, things get complicated fast. The leading case is Kearney v. Salomon Smith Barney, Inc. (2006), where the California Supreme Court ruled that California's all-party consent law applied to calls recorded by employees in Georgia (a one-party state) involving California clients.

The practical rule: if any participant is in an all-party consent state, treat the entire conversation as requiring all-party consent. There is no definitive federal rule resolving cross-state conflicts, and the most protective standard is the safest approach.

This is particularly relevant for telehealth providers. If you are a doctor in Texas (one-party consent) with a patient calling from California (all-party consent), California law likely applies and you need that patient's explicit consent.

The AI Layer: New Legal Complications

Using AI-powered recording devices like the Plaud NotePin introduces legal dimensions that did not exist with traditional recording equipment.

Existing Wiretap Laws Apply to AI

Courts have applied existing wiretap and eavesdropping laws to AI-powered recording and transcription. The technology does not change the consent obligation. Whether a human or an AI listens to the recording, the same rules apply.

Key AI-Specific Developments

California AB 2905 (chaptered 2024) amended Public Utilities Code section 2874, which governs calls placed using automatic dialing-announcing devices. The required announcement must state the nature of the call along with the name, address, and telephone number of the business being represented, ask whether the person called consents to hear the prerecorded message, and inform the person called if the prerecorded message uses an artificial voice. The bill defines an artificial voice as one "generated or significantly altered using artificial intelligence."

Read the scope carefully. AB 2905 targets outbound prerecorded calling, not wearable recorders, and the bill text sets no separate dollar penalty. It signals where AI disclosure duties are heading rather than imposing a rule that governs NotePin use.

The FCC confirmed in February 2024 that AI-generated voices qualify as "artificial or pre-recorded voices" under the Telephone Consumer Protection Act. AI-generated calls cannot evade TCPA coverage.

Illinois BIPA and AI voiceprints present a particularly sharp risk for Plaud users. Illinois's Biometric Information Privacy Act defines a biometric identifier to include a "voiceprint" (740 ILCS 14/10). AI transcription tools that use speaker identification, a feature Plaud actively promotes, may trigger BIPA requirements including written notice, signed authorization, and a public retention policy. BIPA carries a private right of action with liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, plus attorneys' fees (740 ILCS 14/20). That fee-shifting private right of action is why BIPA drives class litigation against transcription vendors.

Cruz v. Fireflies.AI Corp. (C.D. Ill. No. 3:25-cv-03399, filed December 18, 2025) alleged that an AI meeting assistant violated BIPA by distinguishing speakers without BIPA-compliant notice. The docket shows the case terminated on March 11, 2026. A complaint is an allegation, not a holding, so treat this case as evidence of the theory plaintiffs are testing rather than a rule any court has adopted, and check the docket for its current posture before relying on it.

The Capability Test: A Major Expansion of Exposure

In Ambriz v. Google LLC (N.D. Cal. No. 23-cv-05437-RFL, February 10, 2025), the court denied Google's motion to dismiss and applied what is now called the "capability test." At the pleading stage, the court held that alleging an AI vendor has the technical capability to use intercepted data for its own benefit, regardless of whether the vendor actually does so, is sufficient to plead that the vendor is a third-party eavesdropper under California's Invasion of Privacy Act.

A ruling on a motion to dismiss is not a final merits decision, but the reasoning still expands legal exposure for AI recording vendors. If a vendor's terms of service permit using customer data to improve its products, even where the vendor does not currently do so, that capability alone could support a CIPA claim in California.

The Otter.ai Warning

In Brewer v. Otter.ai (August 2025), a class action alleged that Otter's AI notetaker recorded private conversations of meeting participants who were not Otter subscribers, without proper consent. The case highlights a risk applicable to all AI recording tools: default settings that do not seek consent from all parties in a conversation.

Healthcare Recording: Where HIPAA Meets Consent Law

For healthcare professionals, the legal analysis gets especially layered. You must comply with both HIPAA and your state's recording consent laws simultaneously.

HIPAA Does Not Directly Address Recording

HIPAA does not have a specific provision about audio recording. However, any recording containing Protected Health Information falls under HIPAA's privacy and security rules. This means:

• Patient consent is required before recording conversations about their care
• You must explain why recordings are necessary and how they will be used
• All recordings must be encrypted and securely stored
• A BAA is required with any third-party recording service that processes PHI

The Sharp HealthCare Lawsuit: A Cautionary Tale

In a proposed class action filed in San Diego Superior Court and reported in December 2025, Sharp HealthCare was accused of secretly recording exam room conversations during its rollout of Abridge, an ambient AI clinical documentation tool, with more than 100,000 patients potentially affected. The complaint alleged that the AI system automatically inserted false consent statements into patient records, documenting that patients "were advised" the visit was being recorded and that they "consented" when that had not happened.

This case demonstrates exactly what can go wrong when healthcare organizations adopt AI recording tools without rigorous consent practices.

State Medical Privacy Laws Go Further

HIPAA creates a federal floor, but many states impose additional protections:

• In one-party consent states, patients can technically record clinical encounters without the provider's knowledge
• In all-party consent states, covert recording of doctor visits is illegal for everyone
• California AB 3030, signed September 28, 2024, added Chapter 2.13 (commencing with section 1339.75) to Division 2 of the Health and Safety Code. It requires health facilities, clinics, physician's offices, and offices of a group practice that use generative AI for patient communications about clinical information to include a disclaimer identifying the communication as AI-generated, along with instructions for contacting a human provider. The disclaimer requirement does not apply where a licensed health care provider reads and reviews the AI-generated communication before it is sent.

A proposed HIPAA Security Rule update published in January 2025, the first major revision in roughly 20 years, would remove the distinction between "required" and "addressable" safeguards and impose stricter encryption and risk management requirements on systems processing PHI. Proposed rules change before they are finalized, so confirm its current status before building a compliance program around it.

What This Means Practically for Plaud Users

Here is a quick-reference risk assessment for common Plaud use cases:

HIPAA-Compliant Alternatives That Offer BAAs

If you need a recording and transcription tool for healthcare use and want the BAA question settled upfront, some alternatives publicly document Business Associate Agreements. Not all of them do, and we hold competitors to the same evidentiary standard we hold Plaud to. The column below reflects what each vendor's own current materials said when we checked in August 2026:

Verify before you rely on this table. Vendor pages change, tiers get restructured, and a BAA only protects you once it is signed and countersigned. Ask each vendor in writing which contracting tier includes the BAA, and keep the executed copy. Treat any vendor's marketing claim about HIPAA as a starting point for that conversation, not as the agreement itself.

None of these are perfect replacements for the Plaud NotePin's physical form factor. Plaud's hardware, a lightweight wearable that clips to clothing with one-button operation and offline recording, remains well suited for in-person clinical encounters. The tradeoff is between hardware convenience and compliance certainty.

Best Practices for Using Plaud Legally

Whether you are in healthcare or business, following these practices will minimize your legal exposure when using any AI recording device.

For All Users

1. Default to all-party consent. Even in one-party consent states, informing all parties is the safest practice and avoids cross-state complications.

2. Announce recording at the start of every conversation. A simple "I would like to record this conversation for my notes. Is that okay with everyone?" is sufficient in most jurisdictions.

3. Document consent. Keep a log of who consented, when, and how. For important conversations, get written consent.

4. Check state laws before recording. If you are unsure whether a conversation touches an all-party consent state, assume it does. Remember that Oregon's all-party rule applies to the in-person conversations a wearable is most likely to capture.

5. Disable speaker identification in Illinois. If any participant is in Illinois, Plaud's speaker recognition feature could trigger BIPA liability.

6. Review Plaud's data retention settings. Understand where your recordings are stored, for how long, and whether they are used for any purpose beyond transcription.

For Healthcare Professionals

1. Get a BAA from Plaud before using it with patients. Contact them directly. If they will not sign one, do not use it with PHI.

2. Obtain documented patient consent. Use standardized consent forms that specifically mention AI-powered transcription. Verbal consent should be documented in the medical record.

3. Offer clear opt-out options. Patients must be able to decline recording without it affecting their care.

4. Conduct a security risk assessment specific to your use of ambient recording technology, as required by HIPAA.

5. Follow the most protective standard. Comply with both HIPAA and your state's recording and medical privacy laws.

6. Do not rely on Plaud's transcriptions as clinical documentation without review. The Sharp HealthCare lawsuit shows the risk of auto-generated clinical notes without verification.

For Business Users

1. Include recording notices in meeting invitations so participants are informed in advance.

2. Use active consent prompts in virtual meetings. Do not rely on passive platform notifications alone.

3. Update your company's recording policy to specifically address AI transcription tools. Many businesses adopted these tools without updating their policies.

4. Be especially careful in hybrid meetings. Remote attendees may be in different states with different consent requirements.

5. Establish a data retention policy. Keeping recordings indefinitely creates ongoing legal exposure.

Our Assessment

Plaud's security infrastructure is genuinely strong for a consumer-grade AI recording device. The SOC 2 Type II certification, AES-256 encryption, and zero-training data guarantee put it ahead of many competitors on the technical security front.

But their "just ask first" consent guidance is inadequate, and the absence of a publicly available BAA is a significant gap given how aggressively they market to healthcare professionals. A SOAP note template is not a compliance program.

If you are in healthcare: get the BAA in writing before touching patient audio. If Plaud will not provide one, use a competitor that will. The convenience of the hardware is not worth the compliance risk.

If you are using Plaud for business: assume the strictest state law in the room applies and ask consent upfront. It protects you legally and it is simply the right thing to do.

For personal note-taking and voice memos where you are the only party: you are fine. That is where the Plaud NotePin works without legal complications.